CLAIMS 



What is claimed is: 

1 . A method for computer-aided monitoring of a telecommunication network formed of 
devices capable of communication, said method comprising: 

determining activity parameters, each describing activity of at least one of a 
corresponding device and a corresponding service; 

comparing the activity parameters by a statistical estimator trained with training 
data and having a normal range of dependence based on dependences determined between 
the devices; and 

determining from said comparing whether at least one of the devices and 
services in the telecommunication network has a communication performance different from the 
normal range of dependence in accordance with a predetermined criterion. 

2. The method as claimed in claim 1, wherein at least some of the devices are 
constructed as terminals capable of communication. 

3. The method as claimed in claim 1 , wherein the activity parameters are determined 
within a predetermined time interval. 

4. The method as claimed in claim 1, 

wherein said determining of each activity parameter is performed by the 
corresponding device, and 

wherein said method further comprises transmitting the activity parameters to an 
administration unit which performs said comparing and determining based on said comparing. 

5. The method as claimed in claim 1, wherein said determining of each activity 
parameter is performed by an activity parameter determining unit separate from the 
corresponding devices. 

6. The method as claimed in claim 1, further comprising determining communication- 
dependent dependences between at least some of the devices and services. 
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7. The method as claimed in claim 1 , further comprising determining possible directional 
dependences with regard to directions of communication between at least some of the devices 
and services. 

8. The method as claimed in claim 1, 

further comprising determining data of at least some of the devices and services, 

and 

wherein said determining of the activity parameters is based on the data. 

9. The method as claimed in claim 1 , wherein said determining of the activity 
parameters uses all possible pairs of the devices and pairs of services. 

10. The method as claimed in claim 9, further comprising: 

storing the activity parameters determined from the pairs of devices in a matrix; 

and 

determining the normal range of dependence from a structure of the matrix. 

1 1 . The method as claimed in claim 1 , wherein at least one of the following parameters 
is determined as one of the activity parameters 

data packets sent or received by the at least one of a corresponding device and 
a corresponding service, 

processor utilization of the corresponding device, 

a number of predetermined system function calls, and 

existence of at least one of predetermined processes and predetermined 
computer programs. 

12. The method as claimed in claim 1, wherein a neuro-fuzzy model is used as the 
statistical estimator. 

13. The method as claimed in claim 1, further comprising generating an alarm signal 
when at least one device in the telecommunication network differs from the normal range of 
dependence in accordance with the predetermined criterion. 

14. The method as claimed in claim 1 , further comprising at least one of 
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determining a disturbance of one of the devices in the telecommunication 

network; 

determining an unauthorized attempt to access one of the devices; and 
determining an unauthorized access attempt by one of the devices. 

15. A method for computer-aided training of a statistical estimator for administering a 
telecommunication network formed of devices capable of communication, said method 
comprising: 

determining activity parameters, each describing activity of at least one of a 
corresponding device and a corresponding service; 

determining possible dependences between the devices and services from the 
activity parameters; and 

determining from the possible dependences a normal range of dependence for at 
least some of the devices and services in essentially undisturbed states to train the statistical 
estimator. 

16. The method as claimed in claim 15, wherein at least some of the devices are 
constructed as terminals capable of communication. 

17. The method as claimed in claim 15, wherein the activity parameters are determined 
within a predetermined time interval. 

18. The method as claimed in claim 15, 

wherein said determining of each activity parameter is performed by the 
corresponding device, and 

wherein said method further comprises transmitting the activity parameters to an 
administration unit which performs said determining of the possible dependences and the 
normal range of dependence. 

19. The method as claimed in claim 15, wherein said determining of each activity 
parameter is performed by an activity parameter determining unit separate from the 
corresponding devices. 
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20. The method as claimed in claim 15, further comprising determining communication- 
dependent dependences between at least some of the devices and services. 

21. The method as claimed in claim 15, further comprising determining possible 
directional dependences with regard to directions of communication between at least some of 
the devices and services. 



22. The method as claimed in claim 15, 

further comprising determining data of at least some of the devices and services, 

and 

wherein said determining of the activity parameters is based on the data. 



23. The method as claimed in claim 15, wherein said determining of the activity 
parameters uses all possible pairs of the devices and pairs of services. 

24. The method as claimed in claim 23, 

further comprising storing the activity parameters determined from the pairs of 
devices in a matrix, and 

wherein said determining of the normal range of dependence is based on a 
structure of the matrix. 



25. The method as claimed in claim 15, wherein at least one of the following parameters 
is determined as one of the activity parameters 

data packets sent or received by the at least one of a corresponding device and 
a corresponding service, 

processor utilization of the corresponding device, 

a number of predetermined system function calls, and 

existence of at least one of predetermined processes and predetermined 
computer programs. 

26. A method as claimed in claim 15, wherein a neuro-fuzzy model is used as the 
statistical estimator. 
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27. A device for computer-aided monitoring of a telecommunication network formed of 
devices capable of communication, comprising: 

at least one processor to determine activity parameters, each describing activity 
of at least one of a corresponding device and a corresponding service, to compare the activity 
parameters by a statistical estimator trained with training data and having a normal range of 
dependence based on dependences determined between the devices, and to determine from 
said comparing whether at least one of the devices and services in the telecommunication 
network has a communication performance different from the normal range of dependence in 
accordance with a predetermined criterion. 

28. At least one computer-readable storage medium storing at least one computer 
program for computer-aided monitoring of a telecommunication network formed of devices 
capable of communication, to control a processor to perform a method comprising: 

determining activity parameters, each describing activity of at least one of a 
corresponding device and a corresponding service; 

comparing the activity parameters by a statistical estimator trained with training 
data and having a normal range of dependence based on dependences determined between 
the devices; and 

determining from said comparing whether at least one of the devices and 
services in the telecommunication network has a communication performance different from the 
normal range of dependence in accordance with a predetermined criterion. 

28. At least one computer-readable storage medium storing at least one computer 
program for computer-aided training of a statistical estimator for administering a telecommunica- 
tion network formed of devices capable of communication, to control a processor to perform a 
method comprising: 

determining activity parameters, each describing activity of at least one of a 
corresponding device and a corresponding service; 

determining possible dependences between the devices and services from the 
activity parameters; and 

determining from the possible dependences a normal range of dependence for at 
least some of the devices and services in essentially undisturbed states to train the statistical 
estimator. 



20 



